Self hosted vaultwarden, updated from 1.32.5 to 1.32.6

[VLGM-OIEAU]

Hi,

I just updated my docker instance behind apache proxy.
When I try https://x.x.x/admin/diagnostics I now have a "Websocket enabled Error Yes".

Utils.ts:185 [2024-12-17T21:53:56.525Z] Error: Failed to start the connection: Error: WebSocket failed to connect. The connection could not be found on the server, either the endpoint may not be a SignalR endpoint, the connection ID is not present on the server, or there is a proxy blocking WebSockets. If you have multiple servers check that sticky sessions are enabled.
What could be wrong with update process ?

Regards

[BlackDex]

It probably never worked.
Verify your config with the examples here
https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples

[VLGM-OIEAU]

Hi,

Thanks for answer.

I know the examples and my proxy is configured like in example :

SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

<VirtualHost *:443>
ServerName xx.xx.xx
Protocols h2 http/1.1

#/SSL
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM
SSLProtocol -all +TLSv1.3 +TLSv1.2
SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
#Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
SSLCompression off
SSLSessionTickets Off
SSLCertificateFile /etc/pki/SECTIGO/xx.xx.xx.pem
SSLCertificateKeyFile /etc/pki/SECTIGO/xx.xx.xx.key
#\SSL

ErrorLog vaultwarden-error.log
CustomLog vaultwarden-access.log combined

ProxyPass / http://127.0.0.1:8080/ upgrade=websocket
ProxyPreserveHost On
ProxyRequests Off
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
 
#/Admin URL protect
OIDCProviderMetadataURL https://xx.xx.xx/.well-known/openid-configuration
OIDCRedirectURI  /admin/redirect_uri
OIDCCryptoPassphrase xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
OIDCClientID bw
OIDCClientSecret xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
OIDCProviderTokenEndpointAuth my_provider

<Location /admin>
    AuthType openid-connect
    Require valid-user
</Location>
#\Admin URL protect
</VirtualHost>

Websocket worked in the pass and work with 1.32.5. I always use the test URL and web developer tool to validate update.

Regards

[DevSplash]

It probably never worked. Verify your config with the examples here https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples

It is due to an incorrect URL protocol, it should be ws or wss.
pull/5308

[BlackDex]

That is not the case as explained in the PR.
The WebSocket Class will convert it to the correct protocol.

It does this for all modern browsers, unless you are using a very old version which is older then mid 2024, in which case you should update your browser a.s.a.p. in my opinion.

[bokkabonga]

I see the similar behavior. I get the same error on the diagnostics page, but websocket/push notifications still work

[BlackDex]

What browser, version, os?

[bokkabonga]

Yeah the browser was the problem. Updates to the latest firefox ESR-Version and it works again.

Now it starts complaining about the proxy headers. So I will have to take a look at that :D

[BlackDex]

Cool, now your are safe again also for other security bugs in your old version of the browser.

[bokkabonga]

Thats what i get for not updating my linux regulary i guess

[VLGM-OIEAU]

For me now :

Firefox esr 128.5.2 -> websocket enable OK
Firefox 133.0 -> -> websocket enable OK
Edge 120.0.2210.91 -> websocket enable KO
chrome 131.0.6778.139 -> websocket enable OK
chrome 131.0.6778.135 android -> websocket enable OK

But in fact my main problem was that my firewall after firewall update, by default don't allow websocket.... But there stil a problem with edge

[BlackDex]

Since Edge only supports this since v125, it isn't strange it doesn't in v120.
Also, v120 is very old (January 2024) and there are several CVE's in between the latest version and v120 which are already patched. https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security

Running an older version is probably not wise, and i suggest to update a.s.a.p. or request your IT Administrator to do so.
The current version of Edge is v132 which works as it should.

[VLGM-OIEAU]

My mistake, not edge 120 but 130. And the last one is 131 (under linux).
With 131 websocket works.

Regards

[masterkain]

I'm a new user and starting off with vaultwarden/server:1.32.7-alpine (also tried the version without -alpine)
I'm using ingress-nginx on a well working cluster, certificates, annotations and whatnot and yet I cannot connect to wss.

but I don't think the problem is the web server or the way it talks to the backend, but this:

[2024-12-26 08:58:44.650][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL
[2024-12-26 08:58:44.651][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found
[2024-12-26 08:59:02.673][request][INFO] GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiL
[2024-12-26 08:59:02.674][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found

essentially it seems I'm getting 404s? maybe I misconfigured something, any tips? so far everything seems to work but websockets.

[BlackDex]

Probably not. The web-vault might try to check for some files or cached files which do not exist (any more). So it's not a big issues.

[masterkain]

then I don't know what else to check, I spent the night rechecking everything.
anyway this is in the nginx logs:
192.168.1.149 - - [26/Dec/2024:09:17:32 +0000] "GET /notifications/hub?access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJuYmYiOjE3MzUyMDE2MDYsImV4cCI6MTczNTIwODgwNiwiaXNzIjoiaHR0cHM6Ly9rZXljaGFpbi5pY29yZXRlLmNofGxvZ2luIiwic3ViIjoiZTY2MDc5OWUtZGY2NS00MzMyLTliNTktOTZmMTUyNjM4MTFkIiwicHJlbWl1bSI6dHJ1ZSwibmFtZSI6IkthaW4iLCJlbWFpbCI6Im1hcxxxxxxxxxx HTTP/1.1" 404 660 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 1456 0.012 [vaultwarden-vaultwarden-80] ] 10.42.0.229:80 1834 0.001 404 fe8a9c9127cec5a0a368934545f60b51

I censored the long access_token a bit but isn't it weird that it's being shown in the web server logs?

edit: however that might be the bitwarden browser extension, since these 404s happens with the web console closed

edit: yes it's the extension failing for a 404

background.js:2 WebSocket connection to 'wss://keychain.mydomain.ch/notifications/hub?access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJuYmYiOjE3MzUyMDE2MDYsImV4cCI6MTczNTIwODgwNiwiaXNzIjoiaHR0cHM6Ly9rZXljaGFpbi5pY29yZXRlLmNofGxvZ2luIiwic3ViIjoiZTY2MDc5OWUtZGY2NS00MzMyLTliNTktOTZmMTUyNjM4MTFkIiwicHJlbWl1bSI6dHJ1ZSwibmFtZSI6IkthaW4iLCJlbWFpbCI6Im1hc3RlcmthaW5AZ21haWwuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsInNzdGFtcCI6IjBkMDg2YmEyLWZhNTUxxxx' failed: Error during WebSocket handshake: Unexpected response code: 404

[BlackDex]

Ah, you have a 404 on websocket.
It's probably not wise to post messages in an already existing topic which is totally unrelated.

But you either have WebSocket not enabled or nginx configured incorrectly.

I suggest to start a new discussion and post the support string which you can generate in /admin/diagnostics

[masterkain]

changed helm chart vendor, deleted everything I got in the browser and it started working, thanks